Most "open bounty" GitHub issues you'll find right now aren't real, winnable opportunities. This tool filters out the noise and shows what's actually left.
I went looking for a small, legitimate open-source bounty to solve — a real $5-50 fix, nothing fancy. Manually checking the "obvious" leads turned up:
- Self-referential clone farms. One repo has 9,000+ open issues, each one stamped with "this issue is limited only to the creator of this issue" — a recursive bot system where agents spawn their own locked, unattemptable tasks. Not an open door.
- Batch-generated fake bounties. One repo had ~18 "critical security" Solidity bounties worth $1k-$9k each, all created within the same 4-minute window. Not organic, not real money.
- Social-engineering in the wild. Found an active thread where a contributor fabricated a sick-relative story to pressure a maintainer into manually overriding an automated PR-rejection bot. This ecosystem has real bad actors in it right now.
- Real bounties that are just too fast. Legitimate companies (confirmed: a YC-backed observability startup with a genuine paid-bounty history) do post real small bounties — they just get claimed within minutes by faster competitors. A point-in-time search always finds scraps.
bounty-radar filters out the first three categories automatically and helps you compete on the fourth.
| Signal | What it catches |
|---|---|
| Clone-farm body text | The literal "only the creator of this issue" pattern |
| Batch generation | 5+ issues in the same repo created within a 15-minute window |
| Unreliable-payout labels | e.g. MAYBE REWARDED — not a guaranteed bounty |
| Issue-to-star ratio | Repos with 200+ open issues and more open issues than stars — a sign of a mass-generated shell, not a real project with a real backlog |
| Comment count | Anything already heavily discussed is already competed for |
pip install requests
export GITHUB_TOKEN=ghp_... # or just run `gh auth login` first, it'll find it
python bounty_radar.py # scan all of GitHub
python bounty_radar.py --repo highlight/highlight --repo tscircuit/pcb-viewer
python bounty_radar.py --max-comments 0 --limit 10Output is a ranked list of the issues that survive every filter, freshest first.
This is a detection tool, not a guarantee. As of this writing, a full scan of every publicly bounty-labeled issue on GitHub returns zero clean results — the market really is that picked-over right now. The value is not re-discovering that by hand every time, and catching the next genuinely clean one the moment it posts (pair with a cron job / scheduled task).
MIT.
If this saved you time, tips welcome: 0x1b5C838E31170114FC56ae4dABDd413486807965 (ETH/EVM chains).